CVE-2025-68742

An invalid memory access vulnerability was found in the Linux kernel's BPF cgroup subsystem. When update_effective_progs fails due to allocation failure (such as from fault injection), the code replaces the program with dummy_bpf_prog. If a softirq occurs and attempts to run the BPF filter, accessing dummy_bpf_prog.prog->stats triggers an invalid memory access because the dummy program's stats pointer is NULL.

This flaw was discovered via syzkaller with fault injection. The vulnerability requires a specific race condition where a BPF program update fails and a softirq runs the cgroup BPF filter before cleanup completes. While the timing requirements make this difficult to exploit reliably, the invalid memory access can cause kernel crashes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.